46.224.128.127📋 Copy

# IP Intelligence Briefing: 46.224.128.127/32

Classification: Moderate Risk (Risk Score: 40/100)

Date: 2026-06-20

Assigned Analyst: SOC Intelligence Team

## Executive Summary

IP 46.224.128.127 is a Hetzner-hosted cloud compute endpoint located in Falkenstein, Saxony, Germany. While the IP itself shows no direct threat indicators, it resolves to the domain vnc.sofortonline.at (VNC service) and is associated with multiple DNSBL listings (2/8). The infrastructure shows moderate risk due to route instability and minimal reputation signals. No immediate blocking recommended; continue monitoring for behavioral anomalies.

## Infrastructure Profile

## Service Fingerprint

• HTTP Server: nginx/1.24.0 (Ubuntu)
• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS), 22/tcp (SSH)
• TLS Certificate: CN=vnc.sofortonline.at (Let's Encrypt)
• PTR Hostname: static.127.128.224.46.clients.your-server.de
• DNS Reputation: Forward resolution confirmed

## Threat Assessment

Current Risk Score: 40/100 (Moderate)

Threat Indicators:

• No active threat indicators detected
• Not identified as Tor exit node
• Not classified as known attacker or spam source
• Blacklist count: 0 (direct threats)
• DNSBL listings: 2 of 8 total lists (reputation concern)

DNSBL Analysis: The IP appears on 2 DNSBL entries, suggesting prior association with spam or malicious activity. This warrants awareness but does not constitute immediate evidence of current compromise.

## Neighborhood Analysis

Subnet: 46.224.128.127/24

Abuse Density: 1 (Low)

Classification: Mostly clean

Sibling IPs: 1 active, 1 threat-identified

The subnet shows minimal abuse activity overall, indicating this endpoint's risk is primarily derived from individual reputation factors rather than neighborhood contamination.

## Historical Observations

Total Observations: 24

Observation Window: 2026-06-15 to 2026-06-20

Key temporal signals:

• DNS records resolved to both `sofortonline.at` and `your-server.de`
• HTTP response code 301 (redirect) with nginx server identification
• SPF record: `v=spf1 include:spf.easyname.com -all` (sofortonline.at)
• DMARC policy: `p=none;sp=none;adkim=r;aspf=r` (your-server.de)

The IP demonstrates persistent association with legitimate hosting infrastructure domains. No escalation in threat posture observed.

## Related Entities

DNS Associations:

• static.127.128.224.46.clients.your-server.de (repeated)

Network Associations:

• CLOUD-FSN1 (Hetzner data center network)

Campaign Correlation: None detected

## Recommended Actions

Firewall Rules (for reference):

```

iptables -A INPUT -s 46.224.128.127 -j DROP

nft add rule inet filter input ip saddr 46.224.128.127 drop

```

Policy Recommendation: No immediate blocking action required. The IP is hosted on a legitimate German cloud provider and shows association with legitimate business domains. The DNSBL listings and route instability suggest the need for continued monitoring rather than defensive blocking.

Monitoring Parameters:

• Track for changes in DNS resolution patterns
• Monitor for new threat indicator associations
• Watch for changes in TLS certificate subjects
• Observe for lateral connections to known malicious infrastructure

## Conclusion

IP 46.224.128.127 represents a low-to-moderate risk endpoint on Hetzner cloud infrastructure. While the moderate risk score (40) and DNSBL listings warrant awareness, the absence of active threat indicators and association with legitimate hosting domains suggest this is not an immediate threat. Recommend maintaining passive monitoring and avoiding reactive blocking without additional corroborating evidence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.